fix(install): don't enable dev-token auth when GitHub App is selected

When the install wizard (or `fabro install github --strategy app`)
writes GitHub App settings, it now removes "dev-token" from
`server.auth.methods`, mirroring how `write_token_settings` removes
"github" in the opposite direction. Users who want both auth methods
can still configure that explicitly by editing `settings.toml`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/crates/fabro-cli/src/commands/install.rs

@@ -2300,7 +2300,7 @@ client_id = "client-id"
                 .iter()
                 .map(|value| value.as_str().expect("auth method should be a string"))
                 .collect::<Vec<_>>(),
-            vec!["dev-token", "github"]
+            vec!["github"]
         );
 
         let allowed_usernames = doc

lib/crates/fabro-install/src/lib.rs

@@ -215,6 +215,7 @@ pub fn write_github_app_settings(
     if !methods.iter().any(|value| value.as_str() == Some("github")) {
         methods.push(toml::Value::String("github".to_string()));
     }
+    methods.retain(|value| value.as_str() != Some("dev-token"));
     let github_auth = ensure_table(auth, "github")?;
     github_auth.insert(
         "allowed_usernames".to_string(),
@@ -438,6 +439,22 @@ name = "custom"
             github.get("client_id").and_then(toml::Value::as_str),
             Some("client-id")
         );
+
+        let methods = doc
+            .get("server")
+            .and_then(toml::Value::as_table)
+            .and_then(|server| server.get("auth"))
+            .and_then(toml::Value::as_table)
+            .and_then(|auth| auth.get("methods"))
+            .and_then(toml::Value::as_array)
+            .expect("server.auth.methods should exist");
+        assert_eq!(
+            methods
+                .iter()
+                .map(|value| value.as_str().expect("auth method should be a string"))
+                .collect::<Vec<_>>(),
+            vec!["github"]
+        );
     }
 
     #[test]